CVE-2024-4577
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- openwall.com/lists/oss-security/2024/06/07/1Mailing ListThird Party Advisory
- arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/ExploitPress/Media Coverage
- blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlThird Party Advisory
- cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyThird Party Advisory
- devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ExploitThird Party Advisory
- github.com/11whoami99/CVE-2024-4577Exploit
- github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvExploitThird Party Advisory
- github.com/rapid7/metasploit-framework/pull/19247ExploitIssue Tracking
- github.com/watchtowrlabs/CVE-2024-4577ExploitThird Party Advisory
- github.com/xcanwin/CVE-2024-4577-PHP-RCEExploitThird Party Advisory
- isc.sans.edu/diary/30994ExploitThird Party Advisory
- labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ExploitThird Party Advisory
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 846 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 100.0% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.